Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

dwarf-expert — Claude Code skill: what it does, how to install

Inspects DWARF debug sections in compiled binaries, verifies DIE trees, and assists with parsers. Handy when analyzing compiled code.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill dwarf-expert -a claude-code
Open on GitHub

What dwarf-expert does

This skill guides the inspection of DWARF debug sections across compiled binaries. It formulates queries for llvm-dwarfdump or readelf, searches DIE trees by name or memory address, and looks up official specifications on dwarfstd.org. Runtime debugging with gdb and full binary decompilation in Ghidra remain outside its scope.

It covers structural integrity checks using llvm-dwarfdump --verify alongside quality statistics comparisons. When writing code to parse debug entries, it references libraries such as pyelftools, libdwarf, or gimli, while accounting for attribute indirections like DW_AT_abstract_origin.

Linked Mach-O binaries on macOS store DWARF inside .dSYM bundles or object files rather than the main executable. Because pyelftools only parses ELF containers, scripting Mach-O inspections requires sticking with LLVM tooling instead.

What it helps with

  • inspect types and parameters inside .debug_info sections
  • verify debug metadata integrity with llvm-dwarfdump --verify
  • script DIE tree traversals using Python and pyelftools
  • resolve attribute indirection chains like DW_AT_abstract_origin

Example prompts for the agent

  • Verify DWARF integrity in build/app using llvm-dwarfdump
  • Find all parameters of type float * in the debug sections of this binary
  • Help me write a pyelftools script to extract struct member offsets

How to install dwarf-expert

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill dwarf-expert -a claude-code

2Manually: put the files in place

~/.claude/skills/dwarf-expert/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/dwarf-expert/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

vulnerability-scanner sickn33 Guides AI agents through vulnerability assessments using OWASP 2025 standards and attack surface mapping. Useful during pre-release security reviews. Claude Code CX Codex Cursor +1 1,300installs wp-plugin-development WordPress This skill guides WordPress plugin work, from project structure and hooks to admin settings, security checks and release packaging. Claude Code CX Codex Cursor +1 7,900installs shipping-artifacts phuryn Generates core documentation to make vibe-coded applications reviewable before release. It maps architecture, permission flows, and test coverage for audits. Claude Code CX Codex Cursor +1 1,700installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. Claude Code CX Codex Cursor +1 44,800installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. Claude Code CX Codex Cursor +1 52,200installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. Claude Code CX Codex Cursor +1 69,400installs

Questions about dwarf-expert

How to install dwarf-expert in Claude Code?

Run npx skills add trailofbits/skills --skill dwarf-expert -a claude-code in your terminal.

What does the dwarf-expert skill do?

It equips the agent with knowledge to inspect DWARF sections, run verification tools, and write custom parsers for debug entries.

Does it support Mach-O binaries on macOS?

Yes, but linked Mach-O binaries store DWARF in separate .o files or .dSYM bundles. You must point inspection tools at the .dSYM bundle, and keep in mind that pyelftools works exclusively with ELF files.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor